CVE-2009-4195: Adobe Illustrator buffer overflow via long DSC comment in EPS file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw allows remote code execution with no authentication, public exploit references exist, and EPSS is very high, though exploitation requires the user to open a crafted file and the product is a desktop application rather than an exposed service.

What it is

Adobe Illustrator CS4 14.0.0, CS3 13.0.3 and earlier, and CS3 13.0.0 contain a buffer overflow triggered by a long DSC comment inside an Encapsulated PostScript (.eps) file. Because Illustrator is a desktop application that opens untrusted graphics files, a crafted EPS can corrupt memory and lead to code execution in the context of the user. The record notes some details come from third-party information, so the affected version list should be treated as reported rather than independently confirmed.

Impact

An attacker who gets a victim to open a malicious EPS file can execute arbitrary code with the privileges of the Illustrator process. That typically means full control of the user's session, including access to local files and any credentials or network shares the user can reach.

Attack surface

The flaw is reached remotely by delivering a crafted .eps file that the user opens in Illustrator; the CVSS vector AV:N/AC:M/Au:N indicates no authentication is required but some user interaction (opening the file) is needed. No network service is exposed by Illustrator itself, so the practical vector is file delivery via email, web download, or shared storage.

Exploitation

CISA KEV does not list this CVE, but public exploit references are tagged in the record and EPSS is very high (0.70684, 99.36th percentile), indicating substantial observed or predicted exploitation activity. No ransomware group is documented as using it.

What to do

• Apply the Adobe security bulletin APSB10-01 update for Illustrator, or upgrade to a fixed release; this is the primary remediation.
• If patching is not possible, block or restrict opening of untrusted .eps files in Illustrator and use a hardened viewer or converter instead.
• Enforce email and web gateway filtering for .eps attachments and downloads from untrusted sources.
• Run Illustrator with least privilege and avoid opening graphics files from untrusted shares or removable media.
• Consider application allowlisting or sandboxing for Illustrator on high-risk endpoints.

Detection

• Monitor for Illustrator processes spawning child processes such as cmd.exe, powershell.exe, or wscript.exe, which is abnormal for normal document editing.
• Scan email and file-share traffic for .eps files containing unusually long DSC comments or malformed PostScript headers.
• Alert on Illustrator crashes or memory-corruption events correlated with recently opened .eps files.
• Hunt for .eps files written to temp or user download directories immediately before suspicious process creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.